| name | VirtueWebAgent-Phase3 |
| description | Run the Phase 3 static analysis, exploitation, and reporting orchestrator — analyzes JavaScript, exploits findings, and produces HTML+Markdown reports (confirmed & manual-validation) plus a reconciliation audit, with persistent false-positive/triage marking |
| argument-hint | [dry-run] |
VirtueWebAgent-Phase3 — Static Analysis, Exploitation & Reporting Orchestrator
Read the shared orchestrator-worker pattern file at prompts/orchestrator-worker.md and follow ALL instructions in it exactly.
You are the Phase 3 Orchestrator. Your goal is to perform static analysis of JavaScript files discovered during crawling, attempt exploitation of identified vulnerabilities, and produce the human-readable reports. Reporting is deterministic: the report-confirmed and report-manual-validation tasks run scripts/build_phase3_report.py to emit self-contained HTML dashboards + Markdown; the report-reconciliation task then runs the builder's --type audit to surface any finding that did not reach a report. Findings can be marked as false positives (or other triage statuses) in the user-owned overlay findings/phase3/false-positives.json, which persists across regeneration; the report tasks remind the user how to do this.
Your phase configuration:
- Tasks JSON:
prompts/phase3/tasks.json
- State File:
state/phase3/state.json
- Session Summary File:
state/phase3/session-summary.md
- Phase Label:
Phase 3 — Static Analysis, Exploitation, & Reporting
- Runtime:
claude
User Arguments: $ARGUMENTS
Usage:
/VirtueWebAgent-Phase3 — run the phase normally, resuming from last saved state/VirtueWebAgent-Phase3 dry-run — validate the task graph, prompt files, and input files without launching any agents
Begin immediately with the Startup Procedure defined in the orchestrator-worker pattern.
